Public Sector Blog articles

What's Next in Microsoft 365 Copilot for Government

elisabeth_jones — Tue, 15 Sep 2026 15:04:26 GMT

Government agencies need AI that helps employees find information faster, make informed decisions, and advance mission-critical work while supporting the security, compliance, and control their environments require. Today, we announced Microsoft 365 G7 for GCC, bringing productivity, AI, agents, security, identity, compliance, and governance together in one offering designed for government.

That launch is just one piece of a broader expansion of Microsoft 365 Copilot across GCC, GCC High, and DoD environments planned for this fall. Over the next few months, government customers can expect one of the most significant waves of new Microsoft 365 Copilot capabilities yet, spanning advanced AI models, personalized assistance, in-app editing, collaboration, and more.

Read on to explore what is planned for this next wave.

Bring context-aware AI into the flow of work

Across GCC, GCC High, and DoD, Copilot experiences in the next wave are designed to bring more personalized, context-aware AI assistance into the apps and workflows government employees use every day.

OpenAI’s GPT-5.6 expands Copilot capabilities across drafting, summarization, research, and multi-step reasoning, giving employees more ways to use AI for complex knowledge work.

Memory and Personalization within Copilot helps Copilot to adapt to each user’s professional context over time, so assistance becomes more relevant while reducing the need for repeated setup. Learn how to manage Copilot personalization and memory

Edit with Copilot in Word, Excel, and PowerPoint bring inline AI assistance into the core productivity suite, helping employees refine documents, analyze and update spreadsheets, and shape presentations without leaving the flow of their work. Learn how to get started editing with Copilot in Office.

Expanded Copilot Chat experiences in Outlook are designed to let users without an add-on license draw on information from email, calendar, and meetings to identify priorities and prepare for what’s next. Learn more about Copilot Chat in Outlook

The updated Copilot Notebooks experience in the Copilot app is designed to organize related chats, output creations, and references around a project or topic. The same notebook can also be opened in OneNote, giving employees flexibility to move between the two experiences as their work evolves. Learn more about the updated Notebooks experience.
Additional user controls and visual indicators in the refreshed Copilot app experience give employees options for managing how Copilot uses their work context during an interaction. Learn more about the refreshed Microsoft Copilot app experience.

Turn collaboration into action

Three planned capabilities are designed to help government employees collaborate, capture information, and turn conversations into follow-through.

Across GCC, GCC High, and DoD, Copilot in Forms is designed to help teams create structured surveys, apply refinements, and analyze results. Learn more about Copilot in Forms.

In GCC High, a unified Copilot experience across Microsoft Teams Chats, Channels, Calls, and Meetings is planned to help simplify the experience for employees across more of their collaboration workflows. Learn more about using Copilot Chat in Teams.

In DoD, Intelligent meeting recap in Microsoft Teams is designed to generate meeting summaries, action items, and captured decisions, helping participants catch up on key discussion points and identify follow-up actions. Learn more about Intelligent meeting recap.

Together, these capabilities are designed to help government organizations move more smoothly from conversation and information gathering to decisions and action.

Advancing AI for the work of government

These updates reflect Microsoft’s sustained commitment to bringing AI innovation to US Government customers with the security, compliance, and administrative controls their environments require.

Together, these capabilities mark meaningful progress toward a more complete Microsoft 365 Copilot experience across government clouds—one designed to help employees turn information into action, collaborate more effectively, and move mission-critical work forward.

The opportunity ahead is clear: AI that meets government where it works and helps agencies accomplish more for the people they serve.

Stay up to date

Follow the AI at Work Roadmap for the latest on planned Microsoft 365 Copilot capabilities and availability across GCC, GCC High, and DoD.

Public roadmap items are available for all of the features mentioned above:

Memory and personalization within Copilot (GCC, GCC High, DoD)
Edit with Copilot in Word (GCC, GCC High, DoD)
Edit with Copilot in Excel (GCC, GCC High, DoD)
Edit with Copilot in PowerPoint (GCC, GCC High, DoD)
Expanded Copilot Chat experiences in Outlook (GCC, GCC High, DoD)
Copilot Notebooks redesign (GCC, GCC High, DoD)
Copilot in Forms (GCC, GCC High, DoD)
Unified Copilot experience across Teams Chats, Channels, Calls, and Meetings (GCC High)
Intelligent meeting recap (DoD)

Build Your First AI Agent in a Day: Join the M365 Copilot Government Roadshow in Tempe

Abby_Quinn — Mon, 14 Sep 2026 18:44:23 GMT

Your First AI Agent in a Day: Join the M365 Copilot Government Roadshow in Tempe

If you've been wondering how to move from talking about AI to actually creating something valuable with it, this is your opportunity. The M365 Copilot Government Roadshow: Agent Bootcamp is not another lecture about the future of AI. It's a hands-on experience where you'll roll up your sleeves, collaborate with peers, and build a working AI agent in just one day.

The Era of Agents Is Here

Across government organizations, teams are looking for ways to eliminate repetitive tasks, improve employee productivity, and deliver better outcomes. Agents are quickly emerging as one of the most exciting capabilities in AI because they can help automate workflows, answer questions, surface information, and streamline daily work.

But reading about agents and building one are two very different things.

That's why Microsoft is bringing together government leaders, IT professionals, innovators, and Microsoft 365 Copilot users for an immersive workshop designed to help you gain practical, real-world experience.

What Makes This Event Different?

Most AI events leave you inspired.

This one leaves you with something you've actually created.

On October 21, 2026, you'll work alongside Microsoft experts and fellow government professionals to:

Identify high-impact government use cases for agents

Learn what makes an effective AI agent

Explore best practices for instructions, grounding, knowledge sources, and testing

Build a working prototype using Microsoft 365 Copilot Agent Builder and Copilot Studio Lite

Present your solution and learn from other teams

No coding experience required.

Whether you're a business decision maker, program owner, innovation lead, or IT professional, you'll gain practical skills that you can bring back to your organization immediately.

A Full Day of Learning, Building, and Collaboration

This isn't a passive workshop. It's a collaborative build experience.

Throughout the day you'll:

Start with the Fundamentals

Learn what agents are, how they differ from traditional AI experiences, and where they can create the most value in government environments.

See Agents in Action

Experience live demonstrations that bring agentic AI concepts to life and showcase real-world possibilities.

Work in Teams

Collaborate with your peers to identify meaningful government-inspired scenarios and select a use case to tackle.

Build Your Agent

Get hands-on guidance as you design, develop, test, and refine your own prototype.

Showcase Your Solution

Present your team's creation, learn from others, and celebrate innovative approaches during the team showcase and awards session.

Why Government Professionals Should Attend

Government organizations face unique challenges: limited resources, increasing demands, and the need to do more with less.

This workshop is designed specifically with those realities in mind.

You'll discover how agents can help:

Streamline internal processes
Reduce manual work
Improve access to information
Support mission outcomes
Accelerate innovation initiatives
Maximize your Microsoft 365 Copilot investment

Instead of leaving with theory, you'll leave with frameworks, best practices, and practical experience that can help shape future AI initiatives within your organization.

Event Details

📅 Date: Wednesday, October 21, 2026

🕘 Time: 9:00 AM – 4:00 PM

📍 Location: Microsoft Office, Tempe, Arizona 60 E Rio Salado Pkwy #1200 Tempe, AZ 85281

🎯 Audience:

Government IT and digital transformation leaders
Program and mission owners
AI and innovation champions
Business and technical decision makers
Microsoft 365 Copilot users interested in agents
Anyone with an interest in Agentic AI

Seats Are Limited

To maintain a highly interactive, hands-on experience, attendance is intentionally limited. All registrations are initially placed on a waitlist, and attendees will receive confirmation once approved.

If agentic AI is on your roadmap, if you're curious about what agents can do for your organization, or if you're looking for a practical way to get started, this bootcamp is for you.

Ready to Build?

Don't miss the opportunity to learn from Microsoft experts, collaborate with government peers, and build your very first AI agent in a single day.

🚀 Register today: M365 Copilot Government Roadshow: Agent Bootcamp - Tempe, AZ

Come with ideas. Leave with an agent.

Advanced Microsoft Intune capabilities are now available for GCC High

Sarah695 — Mon, 14 Sep 2026 16:00:00 GMT

On July 1, Microsoft expanded the advanced Intune capabilities included with eligible Microsoft 365 G3 and G5 licenses for GCCH at no additional cost. G3 gained Intune Advanced Analytics and Intune Plan 2 capabilities, while G5 gained Intune Endpoint Privilege Management.

As of September, even more value is coming to GCCH customers: Intune Remote Help for G3 and G5, plus Intune Enterprise Application Management and Microsoft Cloud PKI for G5. Availability is phased by workload and tenant, so customers should confirm both licensing entitlement and provisioning status in their tenant.

For defense industrial base and federal customers, this is a substantial addition to what you can do with licenses you already own. Capabilities that previously required a separate Intune Suite add-on purchase now arrive as part of your license, provisioned automatically and ready to configure.

What this changes for your endpoint estate

Most endpoint estates in the defense industrial base and federal government were built around a familiar set of constraints: remote assistance on a separate third-party product with its own identity model, certificate services on costly on-premises CA and NDES infrastructure, manual application packaging, and local administrator rights granted broadly because the alternative was blocking work. Every one of those now has a supported answer inside Intune, governed by your own tenant, conditional access policies, and audit trail. This is not a set of features to evaluate for a future budget cycle. It is capability waiting in the admin center.

What is included in G3 and G5

The table below summarizes the Intune capabilities included in the government suites and their availability in GCC High.

Intune Suite Capability	G3	G5	Status in GCC High
Intune Plan 2	Yes	Yes	Available today
Advanced Analytics	Yes	Yes	Available today
Remote Help	Yes	Yes	September 2026
Endpoint Privilege Management	No	Yes	Available today
Enterprise Application Management	No	Yes	September 2026
Microsoft Cloud PKI	No	Yes	September 2026

If your organization holds Microsoft 365 G5, the capabilities marked available are almost certainly already provisioned. The most valuable thing you can do after reading this post is open the Intune admin center and look: Endpoint Privilege Management policies, the Enterprise App Catalog, and the Advanced Analytics device query experience all appear once provisioning completes.

How to put these capabilities to work

Reducing standing administrator rights

Endpoint Privilege Management lets users run as standard users while still completing the specific tasks that require elevation. Approved applications or processes can be elevated using EPM policy, with elevation activity available for reporting and investigation. Start with a controlled business-unit pilot, review the elevation activity users generate, and build elevation rules from observed business requirements rather than assumptions. For organizations working toward least privilege under CMMC or NIST SP 800-171, this delivers both the control and the evidence that the control is working.

Getting proactive with device data

Advanced Analytics surfaces device health, performance, and anomaly data, moving IT from reactive troubleshooting toward spotting problems before users report them. Device query lets you investigate an individual device, and multi-device query lets you gather data across groups of devices. When a security question arrives with a deadline attached, such as which devices carry a specific software version or whether a configuration is in place, that can replace a manual survey with a query. Query scope and performance vary with device state, connectivity, and the data being requested.

Streamlining application delivery

Enterprise Application Management delivers a catalog of prepackaged applications with catalog-based application creation and simplified update workflows, removing much of the manual packaging work that keeps widely deployed software out of date. A practical first move is to identify several high-volume catalog applications and pilot the available update-management workflow, which can reduce both help desk volume and the vulnerability exposure that comes with lagging versions. Update behavior varies by application, so validate each one against your change control process before broad deployment.

Managing mobile, specialty, and frontline devices

Intune Plan 2 capabilities reach the devices that fall outside a standard laptop fleet, which in the defense industrial base is a large share of them. Microsoft Tunnel for Mobile Application Management provides per-app VPN access to on-premises resources from unenrolled devices, well suited to contractor and bring-your-own-device populations. Firmware over-the-air updates reach the ruggedized Zebra Android devices common on production floors and in logistics operations, where sending a technician to each device is impractical.

Faster, auditable remote support

Remote Help brings help desk sessions inside your own identity and compliance boundary. Sessions use strong authentication, role-based access control, and device compliance checks, and session activity is logged, which gives you a defensible record to draw on when an assessor asks how remote access is controlled. Determine which specific artifacts your assessment framework requires and confirm your logging and retention configuration supports them. Remote Help is targeted for GCC High in September 2026.

Modernizing certificate infrastructure

Microsoft Cloud PKI manages the certificate lifecycle for Intune-enrolled devices and can reduce or eliminate on-premises CA and NDES dependencies for supported Intune certificate scenarios. It supports certificate-based authentication to Wi-Fi and VPN, which removes a password from the authentication path. Many organizations will continue to run on-premises PKI for servers, network infrastructure, application signing, offline roots, and third-party devices, so treat this as consolidation of your device certificate estate rather than wholesale replacement. It is targeted for GCC High in September 2026. The preparation that pays off is an inventory: which certificate templates you issue, which resources consume them, and which dependencies fall within supported Intune scenarios.

What changes for the people using the devices

Users feel this quickly. Someone who needs an approved application, or a task that requires elevation, gets it through policy in the moment instead of filing a ticket. When something breaks, the help desk can see the device and fix it without asking the user to describe what is on their screen. Applications stay current without disruptive catch-up patching. The gains are largest for the workers furthest from IT, including manufacturing and production staff, field engineers, and anyone on a shared or ruggedized device, where a single avoided trip to a support desk is measured in production time.

What changes for your security posture

Each capability closes a familiar exposure. Standing local administrator rights are the most common privilege escalation path on a managed estate, and Endpoint Privilege Management reduces them without removing the user's ability to work. Remote management tooling is itself a target: Microsoft's Digital Defense Report 2025 found that 79% of ransomware attacks in 2025 involved remote management tools on endpoints, a strong argument for consolidating remote assistance onto a tool governed by your own controls. Taken together, these are the practical mechanics of Zero Trust rather than the vocabulary of it. Verify explicitly becomes certificate-based authentication through a managed CA, least privilege becomes elevation by policy with a record of activity, and assume breach becomes device data an analyst can query across the estate.

Recommended next steps for GCC High customers

The steps below are ordered so the quickest wins come first.

Audit what is already provisioned. Open the Intune admin center to confirm what is live in your tenant, then check Message Center for what is arriving next.
Confirm entitlement and user mapping. Identify which users hold G3 and which hold G5, and any population, particularly frontline and production workers, licensed outside those plans that will need a separate approach.
Pilot Endpoint Privilege Management. It is available today, it produces measurable results quickly, and a single business unit gives you the elevation data you need to design broader policy.
Prepare for the September capabilities. Inventory your certificate templates and CA dependencies ahead of Cloud PKI, and define helper roles and session policies ahead of Remote Help, so both can move quickly once they land.
Quantify the overlap. List the third-party remote control, certificate, and application packaging tools these capabilities can replace, along with their annual cost and the separate renewal cycles, credentials, and assessment evidence each one carries. That figure is usually the fastest route to funding an endpoint modernization effort.

Resources

Microsoft 365 adds advanced Microsoft Intune solutions at scale (Microsoft Intune Blog, December 4, 2025) (read the post)
Advanced Microsoft Intune capabilities now available in Microsoft 365 E3 and E5 (Microsoft Intune Blog, July 1, 2026) (read the post)
Advancing Microsoft 365 Government: New capabilities and pricing update (Public Sector Blog, December 4, 2025) (read the post)
Microsoft Intune US Government service description (Microsoft Learn), the authoritative reference for GCC High and DoD feature availability (read the article)
Microsoft Intune licensing (Microsoft Learn) (read the article)

Kick Off the Fall by Building the Future: Join Microsoft's Government Agent-a-thon in Arlington, VA

Abby_Quinn — Wed, 26 Aug 2026 15:57:29 GMT

On September 29, 2026, Microsoft is launching the first event in our FY27 Frontier Innovation Series with an immersive, hands-on experience exclusively designed for Government, Defense, and Education organizations in the Washington DC region. Hosted at the Microsoft Innovation Hub in Arlington, Virginia, this collaborative workshop will help attendees gain practical skills, build working agents, and discover new ways to unlock value from Microsoft 365 Copilot.

The Next Evolution of AI is Here

Most organizations have begun exploring generative AI. Many are already seeing value with Microsoft 365 Copilot. But now the conversation is shifting toward something even more powerful: agents.

Agents can help automate recurring tasks, deliver information in context, support decision-making, and streamline everyday work. The opportunity is significant, but many organizations are still asking:

When should I use Copilot? When should I use an agent? And how do I actually build one?

This Agent-a-thon is designed to answer those questions through hands-on learning and real-world application.

Learn by Building

Rather than spending the day listening to presentations, participants will actively engage in a team-based experience focused on designing, testing, and refining agents using Microsoft 365 Copilot Agent Builder and Copilot Studio.

Working in small groups, you'll explore practical scenarios, experiment with natural language instructions, and leverage Microsoft 365 data to create solutions that support productivity and mission outcomes.

No advanced development experience is required.

Whether you're an IT leader, innovation champion, business stakeholder, or Microsoft 365 Copilot user looking to take the next step, you'll have the opportunity to learn by doing.

Real-World Outcomes, Not Just Theory

One of the reasons Agent-a-thons have become so popular is their focus on tangible outcomes.

The goal isn't simply to learn about agents.

The goal is to leave with ideas, prototypes, and repeatable patterns that can be brought back to your organization.

Throughout the day you'll discover:

How to decide when Microsoft 365 Copilot is the right solution and when agents provide additional value

How to design personal productivity agents using natural language and organizational knowledge

How to identify opportunities to streamline workflows and reduce repetitive work

How to collaborate with peers from other government organizations and learn from their approaches

How to create reusable solutions that can inspire future AI initiatives

By the end of the event, you'll understand not only what agents are, but how they can be applied to solve meaningful challenges within your own environment.

Connect with Peers Across Government

One of the most valuable aspects of this experience is the opportunity to collaborate with others who are navigating similar AI adoption journeys.

Participants will share ideas, exchange lessons learned, receive feedback from Microsoft experts, and discover new approaches that can accelerate success.

Often the most impactful innovation comes from seeing how others are solving similar problems.

Why You Should Attend

If you're:

Curious about agents and agentic AI
Looking to get more value from Microsoft 365 Copilot
Hoping to improve prompting and AI solution design skills
Exploring ways to accelerate productivity across your organization
Seeking practical, low-code and no-code approaches to innovation

Then this event is for you.

Whether you're just beginning your AI journey or looking to move from experimentation to implementation, the Agent-a-thon offers a unique opportunity to gain hands-on experience and build confidence with emerging AI capabilities.

Event Agenda

9:00 AM – 9:30 AM
Arrival & Networking

9:30 AM – 10:00 AM
Generative AI and Government Use Cases

10:00 AM – 10:45 AM
Microsoft 365 Copilot & Agents Masterclass

11:00 AM – 3:00 PM
Team-Based Labs, Building, and Hacking

3:00 PM – 4:00 PM
Team Presentations, Showcase & Awards

Be Part of the Future of Government Innovation

Organizations that succeed with AI won't simply consume technology. They'll learn how to shape it around their mission, people, and processes.

This Agent-a-thon provides a safe, collaborative, and highly interactive environment to do exactly that.

Join Microsoft and your government peers as we kick off FY27 by exploring what's possible with Microsoft 365 Copilot, Agent Builder, and Copilot Studio.

Come curious. Leave inspired. Leave with an agent.

We can't wait to see you in Arlington. 🚀

Register here.

M365 Copilot Government Roadshow is BACK! Kicking off in Atlanta with our First Ever Agent Bootcamp!

Abby_Quinn — Wed, 26 Aug 2026 15:56:45 GMT

This is exactly the kind of event government customers have been asking for: less theory, more building. If you've been hearing about AI agents and wondering how to turn the promise into practical outcomes for your agency, this is your opportunity to roll up your sleeves and create something real.

M365 Copilot Government Roadshow: Agent Bootcamp

Build Your First AI Agent in a Day

The next wave of AI innovation isn't just about asking better questions. It's about creating intelligent agents that can help automate work, streamline processes, and support mission outcomes. On September 29 in Atlanta, Microsoft is bringing together government leaders, innovators, and Microsoft 365 Copilot users for an immersive, hands-on Agent Bootcamp designed to help you go from concept to working prototype in a single day.

This isn't another presentation-heavy event where you sit through hours of slides. It's a collaborative build experience where you'll learn, design, experiment, and create alongside Microsoft experts and government peers facing many of the same challenges as your organization.

Why Agents Matter

Across government, organizations are exploring how AI can help reduce administrative burden, improve employee productivity, accelerate decision making, and enhance citizen services. Agents represent one of the most exciting opportunities to achieve these outcomes.

Think of agents as purpose-built AI assistants that can be grounded in your organization's knowledge, follow specific instructions, and help users complete real work. Whether you're looking to streamline internal processes, improve knowledge access, or support frontline teams, agents can play a critical role in your AI strategy.

The question is no longer if agents will impact government operations.

The question is: How do you get started?

That's exactly what this bootcamp is designed to answer.

What You'll Experience

Throughout the day, you'll be guided through a structured journey that combines learning with hands-on application.

You'll discover:

What agents are and how they differ from traditional AI experiences
How to identify high-value government use cases
Best practices for instructions, grounding, and knowledge sources
How to create agents using Microsoft 365 Copilot Agent Builder and Copilot Studio Lite
Approaches for testing, refining, and scaling agent solutions
Most importantly, you'll apply everything you learn immediately.

From Idea to Prototype

The heart of the event is an interactive build sprint where participants work in teams to solve real government-inspired scenarios.

You Will:

Explore practical use cases

Collaborate with peers

Design an agent solution

Build and test a working prototype

Share your work during team showcases

Learn from the creativity and innovation of other groups

By the end of the day, you'll leave with more than knowledge. You'll leave with hands-on experience, actionable frameworks, and a tangible example of what's possible when you combine government expertise with AI innovation.

No Coding Required

One of the biggest misconceptions about agents is that they require deep technical expertise.

They don't!

Whether you're a business leader, mission owner, IT professional, innovation champion, or existing Microsoft 365 Copilot user, this workshop is designed for you. The focus is on problem solving, design thinking, and practical application rather than software development.

If you can identify a challenge worth solving, you can participate in building an agent.

Who Should Attend?

This event is ideal for:

Government IT leaders

Digital transformation teams

Program and mission owners

AI champions

Business decision makers

Technical decision makers

Microsoft 365 Copilot users interested in expanding into agents

Whether your agency is just beginning its AI journey or already seeing success with Microsoft 365 Copilot, you'll gain valuable insights and practical experience that can help shape your next phase of adoption.

Event Details

September 29, 2026

9:00 AM – 4:00 PM EDT

Microsoft Atlanta South Building

200 17th Street NW

1st Floor MPR 1.1A

Atlanta, GA 30363

Agenda Highlights

Agent Foundations & Live Demonstration

Team Formation & Use Case Selection

Hands-On Agent Build Sprint

Team Showcase & Awards

Take the Next Step in Your AI Journey

The most successful organizations are moving beyond AI exploration and into AI creation. This bootcamp provides a unique opportunity to learn directly from experts, collaborate with peers, and experience firsthand how agents can support government missions.

Seats are intentionally limited to ensure an interactive, high-value experience for every attendee.

If you've been waiting for the right moment to start building with agentic AI, this is it.

Registration closes September 27, 2026.

City of Raleigh from insights to action: A traffic digital twin, live in six weeks

DanNarloch — Tue, 04 Aug 2026 19:06:05 GMT

Raleigh is one of the fastest-growing cities in the United States, and its residents feel that growth every morning, in traffic. Easing congestion has become a priority the whole city can measure.

Understanding how traffic actually moves has traditionally meant sending transportation engineers out to observe intersections and analyze them by hand, a slow and resource-intensive process for a city serving 500,000 residents and 19 million annual visitors. Raleigh saw a chance to approach it differently.

Working with Esri, NVIDIA, and Microsoft, the city built a real-time digital twin of its traffic, a virtual environment where teams can watch conditions unfold and understand what a change would do before making it. Built on Azure, it combines video from existing traffic cameras with AI analytics and geospatial intelligence to give engineers a live view of the busiest intersections in the city.

Raleigh moved from concept to pilot in six weeks, using infrastructure it already owned. "This has not required a single modification to our on-the-streets assets," says James Alberque, GIS and Emerging Technology Manager at the City of Raleigh. The cameras were already on the poles, and the cloud foundation was already in place.

With that foundation in place, Raleigh estimates that optimizing signal timing along one busy corridor could save commuters $9.7 million in time and travel costs. That figure is a projection, not audited savings. It rests on delays cut by seconds per signal, changes most drivers would never notice, spread across thousands of daily trips.

The work is also changing what a small team can cover. Two engineers now have a live view of the network that once took field visits to assemble, creating room to improve safety, tune operations, and look at services beyond traffic.

For governments looking to improve quality of life without new capital, Raleigh's experience carries a useful lesson. Transformation doesn't always mean starting over. Often it starts with reimagining the data and infrastructure already in the ground.

Read the full story to see how Raleigh built it in six weeks, and what two engineers can now cover.

What’s new in Microsoft 365 Copilot for U.S. Government Customers

elisabeth_jones — Thu, 06 Aug 2026 22:46:35 GMT

Many government organizations are evaluating ways to expand the use of AI while maintaining appropriate security, compliance, and administrative controls. Microsoft 365 Copilot helps employees work with information they are authorized to access across Microsoft 365. Administration and compliance capabilities help IT and security teams manage adoption across these experiences.

Since our April update, new capabilities across U.S. Government clouds have expanded what employees can do with Microsoft 365 Copilot and how IT, security, and compliance teams can apply data protection, governance, and adoption controls to their AI workloads.

Microsoft 365 Copilot: Help employees work with organizational knowledge

Microsoft 365 Copilot helps employees work with the information they are authorized to access across Microsoft 365 and connected enterprise sources.

Researcher (now available in GCC-High) supports complex, multi-step research across accessible work content and other configured sources, producing a structured, source-cited report. Analysts can use it to compare evidence, identify patterns, and prepare decision-ready briefs with less manual synthesis. Learn more about Researcher

Microsoft 365 Copilot connectors (now available in DoD) extend Copilot and Microsoft Search to external line-of-business content by indexing it in Microsoft Graph. This lets employees search for and reason over more of the enterprise knowledge they need without leaving the Microsoft 365 experience. Learn more about Microsoft 365 Copilot Connectors.

Shared controls: Govern AI and agents at scale

As adoption grows, IT, security, and compliance teams need controls that help them manage how employees use Microsoft 365 Copilot and how organizations govern agents and AI experiences.

Microsoft Purview Data Loss Prevention for prompts (now available across GCC, GCC-High, and DoD) gives security and compliance teams a real-time control to help safeguard prompts containing sensitive data. Organizations can configure DLP policies to prevent Microsoft 365 Copilot and agents built in Copilot Studio and published to Microsoft 365 Copilot from processing a prompt with a Sensitive Information Type (SIT), as well as from grounding responses on sensitive files or on web search, helping reduce data leakage and oversharing risks. Learn more about Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat.

Agent admin controls (now available across GCC, GCC-High, and DoD) give IT teams centralized options to review, approve, assign, block, or remove agents and manage access by user or group. Learn more about agent administration in Microsoft 365.

Copilot Chat usage reports in Microsoft 365 admin center (now available in GCC, GCC-High, and DoD) help admins understand how employees are adopting and using Copilot Chat. Inform your licensing strategy by identifying power users of Copilot Chat. View total active users, Copilot Chat usage by Microsoft 365 app, and view user level activity data (anonymized by default).

Continuing updates for U.S. Government customers

Together, these releases expand research, knowledge access, reporting, and compliance capabilities available across U.S. Government cloud environments.

Microsoft will continue investing in Microsoft 365 Copilot to help U.S. Government organizations evaluate, adopt, and manage AI experiences in alignment with their requirements.

Reproducing an AI Action Plan Analysis with the Microsoft Discovery App

TimMeyers — Sat, 01 Aug 2026 14:00:00 GMT

Setting the scene

Just over a year ago, I published a three-part series on this blog about using generative AI to analyze the roughly 10,000 public responses (10,067 to be exact) to the OSTP/NITRD Request for Information on the AI Action Plan:

The goal of that series was not to produce a report. It was to give an analyst a way to collaborate with the corpus — to ask questions, surface patterns, and draw their own conclusions from 10,000+ voices that are impractical to read one by one and even harder to hold in your head all at once. Getting there took about a day of AI-assisted engineering: prompt engineering, a model bake-off, standing up cloud infrastructure in Azure, configuring knowledge-graph research packages (GraphRAG ), building a metadata transformation layer, and deploying an MCP server so a custom Copilot could talk to it. A number of technologies, a lot of plumbing, and — importantly — a lot of me doing the work end-to-end.

Fast forward a year. The Microsoft Discovery app is now in preview. I've been experimenting with it to learn how it works, and I wanted to see what would happen if I pointed it at the same corpus. Not as an analysis project — as a capability test. How far could I push it? How much could I hand off? What would it do on its own?

I loaded the corpus. I gave it one vague sentence of intent. I set it to Autopilot. I went to the movies. Three hours later I came back to a fully-graded 43-page research report.

This post is the "one year later" retro: what I still did, what the platform now does for me, and what that shift tells us about where AI-for-discovery is heading.

Case study, pre-released product, and AI disclaimers:

This document is for informational purposes only. Some information relates to pre-released product which may be substantially modified before it’s commercially released and generally available. These results reflect a specific run. Generative AI systems are probabilistic, so repeating the workflow with the same prompts and models may produce different outputs. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY AND WITH RESPECT TO THE INFORMATION PROVIDED HERE. 

What Microsoft Discovery is

Microsoft Discovery is Microsoft's extensible platform that brings together agentic orchestration, advanced reasoning, a graph-based knowledge foundation, and high-performance computing for scientific research and R&D workflows. It ships in two complementary experiences: Microsoft Discovery, the enterprise cloud service running in Azure — generally available with full governance, multi-user collaboration, and scalable compute; and the Microsoft Discovery app, a free download, local-first Windows client currently in preview that runs on your own machine with just a GitHub Copilot subscription. Both operate on the same building blocks:

Discovery Engine to orchestrate autonomous, multi-step, long-running sessions to achieve outcomes.
Bookshelf to provide a platform-native, graph-based, document-reasoning capability.
An agentic AI platform with everything you'd expect — tools, skills, agents — out of the box.

Projects you build in the app are portable up to the enterprise service when you need scale, private data, team collaboration, or compliance.

This post is about the Discovery app.

The experiment, re-run — in three steps

Here's what I actually did. It's short.

Step 1 — Load the data

I created a new Discovery app workspace called aip-for-fun. Ingesting documents is as simple as picking a source — files, a folder, a URL, or the open workspace — from the app's Ingest Documents dialog:

I loaded the AI Action Plan RFI itself into one bookshelf and the 10,067 public responses into another — keeping them separate seemed like a good idea; the RFI is the question and the responses are the answers. Total indexing time: about 15 minutes.

For contrast, in 2025 just cracking those PDFs open and preparing them for GraphRAG indexing was hours of engineering — an Azure Function to convert PDFs to Markdown, another to trigger on new files, all wired through Blob Storage. The Discovery app makes it as simple as pointing it at the folder and letting it go.

Step 2 — Initialize the project

I selected the out-of-the-box project-setup-orchestrator agent in Discovery Chat and gave it one line:

"I want a report analyzing the datasets in the bookshelves."

That's it. That's the whole prompt. I was intentionally vague — I wanted to see what Discovery could figure out on its own.

The orchestrator went to work: it inspected the workspace, found the bookshelves, asked me a clarifying question or two, and drafted a Purpose statement for me to confirm.

From that one sentence and a look at the bookshelves, it produced:

A Purpose statement:

"Systematically analyze the U.S. public's response to the OSTP/NITRD Request for Information on the AI Action Plan (EO 14179, Jan 2025), drawing on a corpus of ~10,067 submissions to characterize who responded, what they asked for, and what those signals mean for AI policy."

Six proposed Outcomes with grading rubrics. I reviewed them, liked them, and added four more where I wanted deeper cuts on specific dimensions. Discovery wrote the rubrics for those too — including a higher-bar rubric for the international competitiveness outcome using a 0–4 Likert scale across four weighted questions. Discovery did the drafting; I did the reviewing and validating.

#	Outcome	Type	Proposed by
1	Respondent Landscape Report	knowledge	Discovery
2	Policy Demand Map	knowledge	Discovery
3	Public Sentiment Analysis	knowledge	Discovery
4	Policy Recommendations Brief	artifact	Discovery
5	Consensus Themes Across Stakeholder Groups	knowledge	Discovery
6	Longitudinal Corpus Comparison	knowledge	Discovery
7	Creative Economy Impact Assessment	knowledge	Tim
8	Sector-by-Sector Policy Divergence	knowledge	Tim
9	Energy and Infrastructure Signal Report	knowledge	Tim
10	International Competitiveness Framing Analysis	knowledge	Tim

From that Purpose and those Outcomes, Discovery generated a hierarchical task graph — 27 tasks across 5 milestones, from source acquisition through respondent characterization, policy demand mapping, sentiment, specialized domains, and synthesis.

Step 3 — Autopilot Go

I switched the chat to Autopilot and typed:

"Work DX-1 to completion."

(A quick aside: Discovery numbers every task in the graph with a unique DX-N ID. DX-1 is always the top-level task — completing it means completing everything under it. You can see the numbering in the task tree screenshot below.)

After project setup, this was essentially a one-shot prompt. I left. I went to see a movie. Three hours later I came back to a task tree that looked like this — every node green:

The task tree above shows six milestones and 32 tasks, not the five and twenty-seven Discovery started with. That's because after Milestone 5 produced the first end-to-end report draft, Discovery graded that draft against the project's ten Outcomes, saw room to strengthen it, and — on its own — added a sixth milestone with five additional tasks to expand depth, regenerate charts, embed local images, and rebuild the PDF. The autopilot run didn't just execute the plan; it revised the plan when the artifact didn't clear the bar.

And behind DX-1: an 831-line, 43-page PDF report with a branded title page, a table of contents, nine narrative sections, three appendices, a bibliography, 18 embedded charts, and rubric grades against every one of the ten Outcomes.

For scale: across the whole project — including setup, the autopilot run, and later polish — there were 34 user prompts, 225 assistant turns, and 386 tool calls. But "34 user prompts" is misleading: I personally typed maybe four or five of them. The rest were Discovery's own agents prompting themselves and each other as they worked through the task graph autonomously. (Full disclosure: I didn't capture token counts on this run — instrumenting that end-to-end is something I'm still working on.)

A look at what came back

The metrics above tell you how the report was produced. What the report actually is is at least as interesting. Here it is.

The report opens with a table of contents, an executive summary, and a set of action-ready conclusions — before it ever gets to the deeper sections. This is the polish layer Discovery added in Milestone 6: not just content, but the kind of structural framing an analyst would expect from a professional research deliverable.

Behind those front-matter pages, the report goes deep. A few examples of what the autopilot run produced:

Respondent landscape. Section 1 characterizes who actually filed — separating the thousands of individual submissions (often a single page or less) from the several hundred organizational filings (typically 8–10 pages, sometimes 40+). This asymmetry matters: it means the same corpus contains both a broad public-sentiment signal and a much smaller set of dense, high-effort policy arguments — and the report treats them differently rather than averaging them together. (This was also one of the first things that jumped out at me when I analyzed the corpus by hand last year — Discovery landed on the same distinction on its own.)

Public sentiment, quantified. Section 2.2 doesn't just say "people are worried" — it breaks tone down by respondent group, showing where concern outweighs enthusiasm and vice versa. It's the kind of chart I'd have had to prompt-engineer and hand-plot last year.

The policy demand map. Section 3 is the ten-theme demand map — a ranked view of what respondents are actually asking the federal government to do, from federal preemption of state AI laws to R&D investment, workforce policy, energy and infrastructure, and international standards leadership.

Sector-by-sector depth. Section 4 breaks the corpus down by sector — creative economy, education, healthcare, financial services, and more — with each subsection surfacing that community's specific policy asks. Education is a representative example: a concise, bulleted list of what educators, districts, and higher-ed institutions are asking for.

The punchline. Section 9.1 closes the report with a decision-ready recommendation table of twelve grounded policy actions, each with its own evidence base and implementation pathway. Alongside it, the report also lays out a recommended implementation sequence across several time horizons — immediate administrative action (0–6 months), near-term regulatory action (6–18 months), and legislative action (18–36 months) — so a reader can see not just what to do, but in what order.

Not a chatbot answering questions one at a time. A brief a policy analyst can read on a plane.

I want to be clear about the framing of this experiment: I was testing what the Discovery app can do on its own. Were I actually doing this analysis for a customer, I'd have worked with Discovery a step at a time — reviewing, redirecting, going deeper in specific areas, catching things the autonomous run might have oversimplified. Autopilot is not the recommended mode for high-stakes work. It's a remarkable demonstration of how much the platform can do when you let it run.

Parting thoughts

Last year I was a data scientist and a software engineer. I was writing summarization prompts, hand-tuning model choices, standing up Azure Functions and Cosmos DB, debugging failed function invocations, wiring MCP servers. I was building the machine AND doing the analysis.

This year I stated my intent, reviewed what the platform proposed, added the outcomes it missed, set it going — and came back to graded artifacts.

Over the last twelve to eighteen months, the software engineering industry has been living through exactly this shift: from writing the code to directing agents that write the code. What's exciting about Microsoft Discovery is that it brings that same shift to the scientific, research, and analysis communities — anyone who follows the scientific method, working with a corpus of research and data, generating new insights and evidence, and trying to reason their way to a defensible conclusion.

The corpus for my experiment was public comments on AI policy. But the same shape of work applies whether you're diving into unstructured public feedback, designing a new quantum chip, or investigating anaerobic genes and bioreactor optimization for advanced biomanufacturing.

If you want to try it, download the Discovery app. After logging in with a GitHub Copilot account, all you really need to bring is a question you'd like to explore, a hypothesis you'd like to test, or an artifact you'd like to produce — or all three. Discovery is ready to help with the rest.

I've done a handful of other Discovery projects since this one. Every time, I push it a little further — follow a thread, ask a stranger question, see how far my curiosity will take me. Every time, it goes.

Where will your curiosity take you?

Empowering the Mission at the Edge with Azure Local

Kevin Mack — Wed, 22 Jul 2026 17:05:33 GMT

Azure Local extends Azure services to customer-controlled locations so mission workloads can run where they are needed—at the tactical edge, or at a forward site. This capability is especially critical in Denied, Disrupted, Intermittent, and Limited (DDIL) environments. It enables hybrid and fully disconnected operations while maintaining consistent security, policy, and lifecycle control.

This post provides a reference architecture that uses Azure Local for mission solutions at the tactical edge. This article is designed to provide a reference for those developing Mission Tactical Solutions, designed to run at the edge and how to enable a platform using Microsoft technologies.

Why is the Edge so important to Mission?

In modern defense operations, decision advantage depends on bringing compute and analytics closer to the point of collection often in environments where reach-back to centralized cloud services are intermittent, degraded, or denied. The ability to run cloud-architected solutions when connectivity to the cloud is limited is a critical requirement for these scenarios. When evaluating the broader defense landscape, several contributing factors shape this requirement and influence how solutions must operate today and evolve over time.

High Data Volume - Military forces and mission partners field more sensors designed to support the warfighter and drive decision advantage. As data volume grows, isolating signal from noise becomes even more important within strict security boundaries and constrained communications.
Increased Pressure to Deliver Value Faster - Edge capabilities are expected to deliver outcomes faster than ever before. Meeting this demand requires solutions that evolve over time while maintaining compliance and security both now and in the future.
Modern Tools and AI Model Access at the Edge - Edge deployments increasingly require AI workloads that isolate signal from noise and sustain decision advantage, even under denied or degraded connectivity.

To address these needs, Microsoft has developed adaptive cloud capabilities that extend Azure patterns to the tactical edge, and this is accomplished with the Adaptive Cloud. Adaptive Cloud and the portfolio of services provide an operating model across hybrid, edge, and IoT environments to enable an operations platform through a single consistent framework.

With the Adaptive Cloud portfolio, the goal is to provide solution teams with the option deploy and operate mission applications closer to the point of need while maintaining governance and lifecycle control.

Azure Local (including disconnected operations), and Azure Arc form a common operational layer for edge environments. Together they help standardize infrastructure, deploy modern applications (VMs and containers), and enforce governance—even when connectivity is limited—so mission systems can be operated, patched, and updated without relying on continuous reach-back.

What is Azure Local?

Azure Local is Microsoft’s on-premises, Azure-consistent platform that extends Azure infrastructure and services to customer-controlled locations so critical workloads can run where they are needed—on the edge—without sacrificing cloud-native agility or security governance. It supports modern VM and Kubernetes workloads locally while maintaining a common operational model with Azure for policy, security controls, and lifecycle management.

In tactical environments, Azure Local helps standardize and harden infrastructure across enclaves and sites, while enabling a platform that can evolve and change over time to meet mission needs.

The result is a more resilient foundation for mission applications in contested or bandwidth-constrained conditions—while reducing operational friction and accelerating fielding.

Recent Announcements:

Recent announcements describe updates to Azure Local for edge and sovereign scenarios, including:

Azure Local disconnected operations (ALDO) is generally available, extending Azure governance and policy to sites with no cloud connectivity.
Foundry Local adds support for large AI models in fully disconnected, sovereign environments.

Over the past year, several customer and partner announcements have expanded validated hardware and deployment options for Azure Local in mission environments.

Curtiss-Wright has announced Azure Local validation for PacStar Tactical Edge Servers: Azure Local validation for PacStar Tactical Edge Servers.
Microsoft has highlighted a partnership with Armada to deploy Azure Local on Armadas Galleon Modular Data Centers (MDC): Azure Local on Galleon Modular Data Centers.

Taken together, these announcements indicate that Azure Local is being validated and deployed for mission workloads at the tactical edge where connectivity, policy, and operational constraints drive the architecture.

Azure Local disconnected operations (ALDO):

Azure Local disconnected operations (ALDO) is designed for missions that cannot support connectivity back to the Azure Cloud. It enables platforms and workloads (VMs, Kubernetes, and other extended services) to run fully disconnected at remote or forward sites, while keeping local control of compute, storage, and networking—and preserving governance intent for policy and configuration when connectivity returns.

Mission Reference Architecture:

As many edge systems modernize, teams move toward container-based solutions and use orchestration platforms such as Kubernetes to run and manage those workloads. Containerization is only part of the broader solution: workloads must also be deployed to edge hardware and sustained over time, including updates, patching, and feature delivery for end users.

With Azure Kubernetes Service enabled by Arc (AKS on Arc) available on Azure Local, teams can deploy and operate containerized applications using Azure-consistent patterns while remaining resilient in disconnected or contested scenarios. Depending on how the Azure Local environment is configured can determine the length of time it can support disconnected durations. Azure Local also supports a cloud-like development experience through infrastructure as code and platform services that accelerate delivery.

Key Components of the Architecture:

Azure Local – Software-defined platform for Azure-consistent operations on approved edge hardware.
Azure Kubernetes Service enabled by Arc (AKS on Arc) – Managed Kubernetes for running containerized workloads with Azure-consistent deployment and operations.
Azure Container Registry (ACR) – Image repository for packaging and deploying container images to the edge.
Azure Arc – Extends Azure management, policy, and security to edge resources when connectivity is available—without making mission operations dependent on constant connectivity.

Cloud Connected Resilient Architecture:

This architecture can be deployed in two configurations to support scenarios where cloud connectivity every 30 days is possible or not. The connected configuration below enables the ability to extend the cloud to the tactical edge, while connectivity is available, but maintains system operations when it is not. Which is the critical element of supporting mission and tactical solutions.

How does Data Flow through this solution?

Collect data at the edge (UAV, TOC, ship, platform systems) to support time-sensitive decisions in operations. The battlefield of the future has an ever-growing array of new sensors and systems that are constantly capturing relevant information to support the warfighter.
Ingest mission data into a local processing environment (AKS enabled by Arc on Azure Local) so analytics can run close to the source, even when reach-back is limited.
Run AI models in Kubernetes pods on the AKS enabled by Arc cluster using validated on-premises edge hardware (including GPU-enabled nodes where required).
Enforce network segmentation to isolate workloads and enclaves, supporting least-privilege access and separation of mission functions.
Replicate container images to the edge using Azure Arc connected registry so updates can be staged when connected and consumed when disconnected.
Synchronize selected data products and model outputs to the enterprise when communications permit, using the preferred transport available in theater and taking advantage of existing or new backhaul investments.
Enable connectivity through deployed tactical network to support connectivity to additional assets and Forward Deployed C2 Systems.
SCP enables secure connectivity between classified tactical edge locations and the Microsoft classified cloud via Microsoft’s global network, which spans more than 175,000 miles of terrestrial and subsea fiber. This connection is used when policy and network conditions allow.
Apply role-based access control (RBAC) and Azure Policy to enforce configuration and compliance with intent from Azure Government to the local environment.
Forward logs, health, and security telemetry to the Microsoft security toolchain when connected to support visibility, triage, and continuous hardening.

What are some of the key architectural considerations?

When architecting this solution, Azure Local offers features that improve adaptability and support future evolution of the platform.

Azure Local and Infrastructure-as-code – Infrastructure-as-code at the edge strengthens security control through policy enforcement while preserving flexibility as new services become available.
Enable Remote Monitoring and Management Plane – Through Azure Arc, Azure Local is able to be remotely managed and monitored when connectivity is available, including pushing updates without needing on-site system administration support.
Cloud Development Mirrored on the Edge Device – Platform-as-a-Service offerings on Azure Local let developers build in the cloud using the same approach used at the edge, improving scale and test coverage during development.
Azure Local Provides Scalable Solutions for the Edge – With the right partner hardware, Azure Local can be sized for mission environmental needs, making it possible to scale deployments across configurations and sites.
Enabling GitOps and Registry Mirroring for Application Deployment – Azure Arc combined with Azure Local helps standardize containerized application delivery through GitOps workflows and registry replication, so updates can be staged when connected and consumed when disconnected.

What are the advantages of this architecture?

Power AI at the tactical edge – Run GPU-enabled, containerized models locally with consistent platform services.
Extend cloud operations patterns to the edge – Use AKS and infrastructure-as-code to deliver repeatable deployments, lower-touch sustainment, and faster updates across sites.
Platform that evolves with mission needs - Abstracting the underlying hardware helps teams adapt and extend solutions over time.

What are the key integrations?

AKS management (onsite or remote from cloud) – Use Azure Arc-enabled Kubernetes for centralized management when connected and resilience when disconnected.
Registry replication – Use Azure Arc Connected Registry to replicate images from cloud registries to the tactical edge.
Policy enforcement – Apply Azure Policy locally to drive compliance and configuration consistency, even while disconnected.
Logging + security integration – Integrate with Azure Arc and Microsoft Defender to support monitoring and security posture across dispersed edge deployments.

Fully Cloud Disconnected Architecture:

This architecture can be deployed in scenarios where there is no ability to connect back to the cloud to support management and operations. The disconnected configuration below enables the ability to leverage cloud deployment patterns at the tactical edge, and enables an enhanced platform and technologies despite never connecting to the cloud.

The primary difference between the architectures being that the solution can be configured to support never being connected to the cloud. In which case, the solution would only connect to the tactical network. In this scenario, by design there is no option for remote management via arc, but the capabilities of Policy Enforcement, Infrastructure-as-code, and hardware platform abstraction are all still available.

Adaptive Cloud and Innovation at the Edge:

Azure Local and Microsoft technologies bring cloud capabilities to the tactical edge while maintaining resiliency amid uncertain connectivity and changing mission needs.

For additional background on Microsoft’s Defense and mission offerings, see the Defense and Intelligence Solutions site: Defense and Intelligence Solutions | Microsoft AI

For questions about this architecture or edge deployment scenarios, you can contact the mission team at mission@microsoft.com.

Microsoft SPARK: Powering America’s Genesis Mission for Scientific Discovery

bryanlopez — Fri, 26 Jun 2026 15:38:01 GMT

The Genesis Mission: A National Commitment to Discovery

The U.S. Department of Energy announced the Genesis Mission as a historic national effort to use the power of artificial intelligence to accelerate scientific discovery, strengthen national security, and drive energy innovation. The Genesis Mission brings together the DOE’s 17 National Laboratories, advanced experimental facilities, large-scale scientific datasets, and next-generation computing resources into a more integrated scientific discovery platform. The goal is to double the productivity and impact of American research and innovation within the decade by embedding AI directly into the scientific process.

This initiative builds on the Removing Barriers to American Leadership in Artificial Intelligence Executive Order. It also advances America’s AI Action Plan, a directive to reduce dependence on foreign adversaries and unleash the full strength of America’s scientific enterprise. DOE officials describe Genesis as building a “national AI platform for scientific discovery,” where labs can combine traditional simulation with generative and agentic AI for fields ranging from fusion and grid optimization to climate modeling and materials science.

Introducing SPARK: Microsoft’s Answer to the Mission

Microsoft’s Scientific Partnership Advancing Research & Knowledge (SPARK) is a mission-aligned program designed to help DOE National Laboratories accelerate AI-for-science outcomes for the Genesis Mission. SPARK combines disciplined program execution, hands-on technical delivery, and significant investments in AI and scientific computing services — so high-value pilots can be selected quickly, delivered predictably, and scaled into secure, compliant, repeatable production workflows.

SPARK alignment focuses on 5 key pillars:

1. A Dedicated Program Management Office

Microsoft is standing up a dedicated PMO to serve as the front door for Genesis Mission collaboration and the coordinating hub for the full breadth of resources Microsoft brings to bear. The PMO will orchestrate engagement across Microsoft program, technical, research, engineering, security, compliance, partner, and field teams — ensuring DOE and the National Laboratories have a clear, consistent path to access Microsoft expertise, align priorities, remove blockers, and move high-value use cases from intake through delivery. This includes project intake and selection, sprint and checkpoint cadence, cross-team resource coordination, capacity planning, and an operational interface with DOE for alignment, reporting, and sustained partnership.

2. An AI-for-Science Center of Excellence

Operating under the PMO, Microsoft’s COE is an integrated delivery team helping DOE labs move AI-for-science use cases from concept to secure, compliant, scalable implementation — spanning solution design, data and AI engineering, HPC-enabled training and inference, and production workflow automation. The COE provides enablement through office hours, hackathons, and targeted training, with emphasis on responsible AI and reproducible research pipelines. It also maintains reach-back to Microsoft research and engineering teams to help labs evaluate and leverage emerging capabilities.

3. Substantial Azure Cloud Service Credits

Microsoft is making available significant Azure cloud service consumption credits to support DOE-sponsored research initiatives. Credits will be allocated to projects that use Microsoft technology to accelerate science, with preference for rapid adoption of AI services and joint DOE–Microsoft researcher participation.

4. Professional and Technical Services Investment

Microsoft is making available dedicated investment funds to support professional and technical services for DOE National Laboratories — helping labs adopt and operationalize Microsoft AI-for-science capabilities. These services can be delivered by Microsoft teams or Microsoft-approved partners.

5. Joint Research & Development

Microsoft and DOE labs will jointly select a focused set of Genesis-aligned challenge problems for co-development — combining Microsoft research expertise with DOE scientific leadership and facilities. Collaboration may include joint experimental and computational work, scientific validation using DOE lab capabilities, and joint AI-for-science model training and evaluation. Milestones and success criteria will be co-defined; publications, IP, and data use will follow mutually agreed terms.

"An undertaking the magnitude of the Genesis Mission only works when partnership and discipline match the energy behind it. The SPARK PMO's role is to keep Microsoft and DOE moving as one team — capitalizing on every bit of momentum to deliver tangible outcomes quickly to turn our shared ambition into mission-scale science."

- Clementine Wall, Director, SPARK Program Management Office

The Technology Behind SPARK

SPARK is powered by the full breadth of Microsoft’s enterprise cloud and AI portfolio — a proven, secure, and FedRAMP-authorized technology stack built for the demands of government science. Key capabilities include:

Azure Cloud Infrastructure — Hyperscale compute, storage, and networking purpose-built for high-performance scientific workloads, with government-grade security and compliance accreditations spanning unclassified to Secret environments.

Azure AI Foundry & AI Models — A unified platform for building, deploying, and governing AI and machine learning models at and agents scale, giving DOE researchers access to frontier AI capabilities within a controlled, auditable environment.

Scientific Computing — GPU and CPU resources optimized for simulation, model training, and inference workloads that complement DOE’s on-premises HPC systems at the National Laboratories.

Cybersecurity Tools — Microsoft Defender, Sentinel, and Entra ID provide layered, Zero Trust security across the research environment, protecting American science by meeting NIST 800-53 standards and supporting continuous compliance monitoring.

Data Lakes & Analytics — Azure Data Lake and Fabric enable labs to ingest, store, and analyze massive scientific datasets across disciplines — breaking down silos and creating a unified data foundation for AI-driven discovery.

Microsoft Discovery — Building on these foundational components is Microsoft Discovery — Microsoft’s integrated science platform that brings together AI models, simulation, data, and experimental workflows in a single governed environment. Microsoft Discovery is designed to match how modern science operates: across labs, disciplines, and data types.

Advanced cognition capabilities enabling autonomous workflow orchestration: AI-driven planning, execution, and adaptation of complex scientific workflows under researcher direction. Together, this technology stack gives DOE scientists the tools to move faster — from hypothesis to discovery — without compromising the security, reproducibility, or governance standards that mission-critical research demands.

Why This Matters

Under its Genesis Mission agreements, Microsoft is effectively becoming part of the federal R&D stack — providing hyperscale compute, advanced models, and tooling that runs alongside DOE’s own high-performance computing systems at national labs like Argonne and Los Alamos. The program is explicitly framed as a way to boost scientific productivity and reduce reliance on foreign technology as AI demand continues to grow.

Ultimately, SPARK is designed to turn Genesis Mission priorities into measurable scientific outcomes — combining disciplined execution, hands-on delivery, and targeted investment to move the most promising use cases from selection to mission-scale impact across the DOE and National Labs.

America’s scientific leadership is not just an academic achievement. It is a national security imperative and an economic engine. With SPARK, Microsoft is committed to making sure that leadership is not just maintained — but accelerated.

For more information, reach out to your Microsoft Account Team or email genesismission@microsoft.com

Bryan Lopez is a Senior Director for Federal Strategic Science Missions at Microsoft and functions as the leader for the Genesis Mission program and partnership at Microsoft.

Join us at Microsoft 365 Copilot Discovery event in Huntsville, AL! - UPDATED LOCATION AND DATES!

Jake Kappus — Tue, 12 May 2026 19:28:08 GMT

Same mission. Tighter format. More signal, less noise.

We've redesigned the Microsoft 365 Copilot Expo & Discovery into something more valuable: two focused, small-group sessions where you can ask real questions, see real demos, and leave with something you can actually use!

The Updated Format:

Two action packed sessions!

Session 1	10:00 AM – 12:00 PM
Session 2	1:00 PM – 3:00 PM

Each session runs two hours and includes:

Mythbusting AI
We take the most common assumptions about AI head-on. What's true, what's overblown, and what actually matters for your work
Featured Presentation
A focused look at how Microsoft 365 Copilot applies in the government clouds.
BONUS! Self-Guided Demo Room
Step in, step out, explore at your own pace. Real tools. Real scenarios!

The Date and New Venue:

📅 Date: Tuesday, May 19, 2026

NEW LOCATION!
📍 UAH Invention to Innovation Center (I2C), 850 Ben Graves Dr NW, Huntsville, AL 35816

Who can attend this event?

All U.S. Federal Government employees, U.S. Department of War personnel, Defense Industrial Base and Defense Contractors.

Register now → https://aka.ms/milehuntsville
Questions? → eMail: mileeventsteam@microsoft.com

Three days. Six experiences. The launchpad your Copilot rollout has been waiting for.

Strengthening Microsoft 365 and Copilot in Government Clouds with In-Product User Feedback

jacobcamp — Mon, 13 Apr 2026 15:00:00 GMT

Delivering secure, reliable, mission-aligned productivity experiences in government clouds requires ongoing collaboration between Microsoft and the public sector organizations we serve. As organizations deploy Microsoft 365 apps and Copilot, tenant administrators need a way to understand how these experiences perform in real-world environments and pass that feedback on to Microsoft.

In-Product Feedback enables IT leaders to capture end-user signals inside Microsoft 365 and Copilot while keeping controls aligned to their compliance posture. In GCC, GCC High, and DoD, In-Product Feedback helps IT leaders spot mission-impacting experience issues, capture environment-specific needs, and share actionable signals with Microsoft.

Feedback Options for Government Clouds

Tenant administrators can choose between two configurations. The table below summarizes the key differences to help you decide what is appropriate for your environment and governance model.

Decision area	Restricted Feedback *(Default)*	Verbatim Feedback *(Admin-Enabled)*
What users can submit	Thumbs up / thumbs down and optional Microsoft-defined categories. No written comments.	Thumbs up / thumbs down and optional written comments. Categories available where applicable.
Where feedback is collected	Copilot experiences only.	Microsoft 365 and Copilot experiences.
Admin action required	None. Available by default.	Enable in Microsoft 365 feedback policy settings.
Operational use	Identify broad experience trends across your organization(s).	Identify and help understand mission-impacting usability or workflow opportunities.
Engineering influence	Supports aggregate experience analysis.	Supports engineering understanding of environment-specific feature behavior.
Why choose it	Low-friction signal at scale, with structured inputs aligned to tighter governance requirements.	Richer scenario context to help accelerate triage and improvement of specific product or feature challenges.

Value for Tenant Admins and IT Leaders

In-Product Feedback provides:

Early visibility into user experience trends and mission-workflow issues
A clear signal path to share environment-specific issues with Microsoft engineering
Real-world input to guide Copilot rollout, adoption, and support
Evidence to inform operating model, governance, and change-management decisions
Data-driven input that helps prioritize future product improvements

Choosing Restricted or Verbatim Feedback enables tenant admins to adjust the signal they receive and the data they share based on their governance, compliance, and support model.

How Microsoft Uses Feedback from Government Clouds

Feedback submitted by users in GCC, GCC High, and DOD environments is reviewed in aggregate to:

Detect recurring user experience challenges in sovereign cloud deployments
Prioritize quality improvements relevant to usage scenarios for these environments
Refine feature behavior across Microsoft 365 and Copilot workloads
Inform roadmap planning for GCC, GCC High and DOD environments

Microsoft uses these aggregated insights to help improve product quality in sovereign cloud deployments — triaging recurring issues, validating feature behavior, and informing product decisions across Microsoft 365 and Copilot for GCC, GCC High, and DoD.

Get Started Today

Tenant administrators can either:

Enable Verbatim Feedback in Microsoft 365 feedback policy settings to allow users to include optional written comments. Tenant administrators should consider this option when: richer scenario context is needed for Microsoft 365 and Copilot, piloting or deployed Microsoft 365 Copilot, investigating workflow-specific items, exploring deployment adjustments, or collaborating with Microsoft to explore and address capabilities or feature behavior.
Take no action to keep Restricted Feedback available using sentiment-based responses (i.e., thumbs up/thumbs down).

Choose the option that fits your governance model and together we can keep improving Microsoft 365 and Copilot.

To learn more about managing feedback policies in Microsoft 365 visit the following resources:

From Fragmentation to Resilience: Why Next Gen “Whole of State” Is Future of Pub Sec Cybersecurity

CyberCorey — Mon, 06 Apr 2026 11:00:00 GMT

Each year at the Billington State and Local Cybersecurity Summit, one message comes through clearly: the cyber threat landscape facing state and local governments is accelerating faster than traditional models of defense can keep up.

Cyber risk is no longer confined to a single agency, system, or jurisdiction. It spans emergency management, education, healthcare, critical infrastructure, and the workforce itself. At the same time, public sector leaders are being asked to modernize services, adopt AI responsibly, and do more with constrained resources.

These pressures are not isolated—and neither can the response be.

That is why Microsoft is focused on a Next Gen Whole of State approach: a state-wide, coordinated model that brings together cyber defense, risk management, and workforce development into a unified strategy—designed for scale, resilience, and trust.

Why “Whole of State” Matters Now

Many states have invested significantly in cybersecurity over the past decade. Yet most efforts remain fragmented—with agencies operating independently, duplicating tools, and competing for scarce talent.

Internal Microsoft analysis and field experience show that this model creates three persistent challenges:

Limited visibility across agencies and jurisdictions
Inconsistent security posture and response capability
Ongoing workforce shortages that slow modernization efforts

A Next Gen Whole of State program is designed to address these challenges holistically. It is a state-wide shared services model that improves efficiency, strengthens critical infrastructure defense, and accelerates AI and cyber talent development—while respecting the autonomy of individual agencies.

This is not about centralizing control. It is about coordinating outcomes.

Cybersecurity as Critical Infrastructure

At Billington, state and local leaders consistently emphasize that cybersecurity must be treated as critical infrastructure protection, not simply an IT function.

Next Gen Whole of State reflects that reality by enabling:

Shared cyber services across agencies and local governments
Proactive identification of vulnerabilities and “slow-burn” risks
Streamlined collaboration during incident response and emergencies

By aligning technology platforms, processes, and partners, states can move toward a more collective defense posture—reducing duplication while improving resilience across the entire ecosystem.

This approach supports more consistent policy enforcement, better situational awareness, and more efficient use of limited funding—priorities that resonate strongly across the state and local community.

Workforce Development Is a Security Imperative

Another theme that consistently surfaces at Billington is the workforce challenge.

Technology alone does not secure a state. People do.

Next Gen Whole of State explicitly integrates workforce and economic development into the security strategy. Through hands-on skilling, apprenticeships, and industry-recognized certifications, states can help build sustainable pipelines of AI and cyber talent using real-world platforms and tools.

This model supports:

Career-ready training aligned to actual state and local needs
Opportunities for students, veterans, and career changers
Long-term reduction in dependency on external resources

By investing locally, states strengthen both their security posture and their communities—an outcome public sector leaders increasingly view as inseparable.

Microsoft’s Role: Thought Leadership at Scale

Microsoft’s contribution to Next Gen Whole of State is grounded in three principles reflected across our public sector work:

Unified platforms that span identity, security, compliance, and AI
Cross-sector collaboration, connecting government, education, and partners
Responsible innovation, aligned with Zero Trust and secure-by-design practices

This enables states to move beyond isolated pilots toward enduring, state-wide programs—while positioning themselves to adapt as threats and technologies evolve.

Importantly, Whole of State also creates a framework for consistent executive engagement, allowing leaders to align strategy, funding, and outcomes around a shared vision.

Looking Ahead

The conversations happening at Billington reflect a broader shift underway across the public sector.

States that lead in the next decade will be those that:

Treat cybersecurity as a shared responsibility
Align technology, policy, and workforce strategy
Build trust through resilience, transparency, and scale

Next Gen Whole of State is not a single product or program.
It is a strategic approach to how states protect critical infrastructure, modernize services, and prepare their workforce for an AI-driven future.

And it is increasingly clear that this approach is no longer optional—it is foundational.

Join the Conversation

Microsoft continues to work with state and local leaders, educators, and partners to advance Next Gen Whole of State initiatives across the country.

To learn more or engage with the Microsoft Security community, visit the Microsoft Tech Community and continue the conversation.

Continuing our momentum: Expanding Microsoft 365 Copilot capabilities across U.S. Government clouds

elisabeth_jones — Thu, 02 Apr 2026 16:00:00 GMT

In December we announced the availability of Microsoft 365 Copilot for customers in GCC‑High—an important milestone in bringing work‑ready AI to organizations that meet the required security and compliance thresholds. Since then, we’ve continued to make steady progress expanding Copilot capabilities across GCC, GCC‑High, and DoD, building on earlier launches and deepening the value customers can access today.

With the rollout of the Analyst and Researcher agents and expanded agent creation capabilities in U.S. Government clouds, we’re marking another step forward in our commitment to delivering Copilot experiences to public sector customers—deliberately, responsibly, and ready for use from day one.

Agentic experiences, built for U.S. Government clouds

Agentic capabilities in Copilot for U.S. Government clouds now include Researcher and Analyst, along with Agent Builder and Copilot Studio publishing to create and share agents.

Researcher (rolling out now, starting with GCC) supports multi‑step research by gathering and synthesizing information across work content to produce clearer, grounded drafts—within U.S. Government cloud security and compliance boundaries. Learn how to get started with Researcher today.

Analyst (now available in GCC, GCC-High, and DoD) supports data analysis by turning information into structured insights and visualizations for decisions and briefings, including pattern detection and clear summaries of large volumes of information. Learn how to get started with Analyst today.

Agent Builder (now available in GCC and GCC-High) expands agent creation capabilities in U.S. Government clouds by enabling users to package instructions, prompts, and work knowledge into reusable agents that help ensure more consistent Copilot responses—grounded in the right organizational context and shareable across teams. Learn more about Agent Builder.

Publishing Copilot Studio Agents to Teams and Microsoft 365 (now available in GCC) extends agentic experiences to the tools users rely on every day. By enabling agencies to make vetted, purpose-built agents available directly in familiar Microsoft 365 surfaces, this capability helps scale consistent, role-relevant guidance and workflows—while keeping usage within the same security and compliance boundaries of U.S. Government clouds. Learn how to connect and configure an agent for Teams and Microsoft 365.

What else is new this quarter

Many core Microsoft 365 Copilot capabilities have also been enhanced in U.S. Government clouds in recent months, including:

Updated OpenAI models (GCC, GCC-High, DoD): Microsoft 365 Copilot for U.S. Government now leverages GPT 5.1 for Copilot Chat, GPT-5 for reasoning, and GPT-4o for image generation, supporting more accurate and contextual responses.

Microsoft 365 Copilot app enhancements: Copilot Search (GCC, GCC-High, DoD) helps users find relevant info across work content; the Create module (GCC, GCC-High) helps draft and refine images and other content.

Copilot Chat improvements (GCC, GCC-High, DoD), including enhanced language understanding for clearer, more accurate responses; Code Interpreter for in-chat data analysis and complex problem solving; and image upload with OCR to extract text for summaries, interpretation, and next steps.

Microsoft 365 Copilot Connectors (GCC, GCC-High) expand access to relevant third-party and line-of-business data sources to ground Copilot experiences in more of your organization’s knowledge. Learn more about Microsoft 365 Copilot Connectors.

In-product user feedback (GCC, GCC-High, DoD). U.S. Government users can now submit in-product feedback directly within Microsoft 365 and Copilot to help improve product experiences for mission work.

All these capabilities – agentic and otherwise – are built to support applicable regulatory and compliance requirements out of the box. U.S. Government compliance needs—including data residency, operational isolation, and restricted personnel access—are carefully considered prior to release, reducing the need for administrators to retrofit controls, disable features, or manage separate compliance workflows.

Moving forward

Delivering Copilot to U.S. Government clouds is a journey, not a single moment. Each new capability reflects a careful, staged approach to availability—helping to ensure features are compliant by design and usable as-is by government organizations.

For guidance on leveraging Microsoft 365 Copilot effectively, visit the Microsoft 365 Copilot for US Government Adoption site. Admins can also review how to manage Copilot agents in the Microsoft 365 Admin Center to help make the most of new agentic capabilities as they roll out.

We’ll continue to share updates as additional Microsoft 365 Copilot features continue to roll out across GCC, GCC‑High, and DoD. Thank you to our government customers and partners for your continued engagement and feedback. Your input helps shape how we responsibly bring AI to mission critical work.

Microsoft 365 Copilot Prompt a thon for Government is Coming to Ft. Lauderdale

Abby_Quinn — Fri, 20 Mar 2026 17:37:18 GMT

On April 16, Microsoft is bringing the Microsoft 365 Copilot Prompt‑a‑thon – Government Roadshow to Ft. Lauderdale, Florida, inviting all Government customers to experience Copilot in action through a hands‑on, in‑person session.

This government‑focused Prompt‑a‑thon is designed to help public sector organizations move beyond AI awareness and into practical, responsible use of Microsoft 365 Copilot. Attendees will learn how to apply effective prompting techniques to real‑world scenarios that reflect how government and education teams work every day.

What You’ll Experience

Participants will:

Practice using Microsoft 365 Copilot through guided, hands‑on exercises
Learn practical prompting techniques tailored to government and education workflows
Explore real scenarios relevant to policy, operations, communications, and IT teams
Leave with skills and examples they can immediately apply and share

This is an interactive working session—not a lecture—focused on learning by doing.

Who Should Attend

This event is designed for:

Federal End Users
State and Local Government professionals
Education sector customers
Commercial users
IT, program, policy, communications, and innovation leaders
Teams beginning or expanding their Copilot adoption journey

Whether you’re exploring Copilot for the first time or looking to drive broader adoption, this session is built to meet public sector needs.

Join Us in Florida

Attending in person provides the opportunity to learn alongside peers, ask questions in real time, and engage directly with Microsoft experts who support government and education customers.

Register HERE

Built on Trust: Microsoft’s Commitment to FedRAMP High and Federal Cloud Security

PaulLorimer — Thu, 19 Mar 2026 14:54:44 GMT

Microsoft builds cloud services for the U.S. government with one foundational principle: trust. For federal agencies, that trust is anchored in FedRAMP—a rigorous, government-led framework designed to ensure cloud services meet the highest security standards. The FedRAMP process plays a critical role in protecting government missions. It is a process Microsoft takes seriously, and we invest significant resources in building products that meet FedRAMP requirements and are secure-by-design and secure-by-default.

We unequivocally stand by all of our products and services for the U.S. government, as well as our FedRAMP authorizations and adherence to the FedRAMP process. While we recognize that conversations about security and compliance are both important and essential, recent flawed reporting seeks to undermine confidence in the U.S. government’s FedRAMP process and our Office 365 products.

To be clear, Office 365 GCC High is a fully authorized service at FedRAMP High following a comprehensive and exhaustive technical review by authorizing agencies, accredited third-party assessors, and the FedRAMP Program Management Office (PMO). Additionally, the service is continuously monitored, annually audited, and supported by one of the industry’s largest and most extensive security and compliance teams.

Why FedRAMP High Authorization Matters

FedRAMP High represents rigorous cybersecurity authorization framework. Its mandate is designed to validate that cloud services meet consistently high security standards. Authorization is grounded in independent verification by an accredited third‑party assessment organization (3PAO), which conducts a comprehensive evaluation of a provider’s security controls. Final risk acceptance rests with federal agency Authorizing Officials, supported by oversight from the FedRAMP PMO, which enforces standardized requirements and review processes across agencies.

Critically, FedRAMP authorization is not a one‑time certification, but an ongoing compliance posture. Cloud service providers must maintain continuous monitoring, including regular reporting, vulnerability management, incident response activities, and demonstrate sustained adherence to FedRAMP High requirements over time. This continuous oversight model reflects the reality that security risk evolves.

Office 365 GCC High Authorization Process

The authorization of Microsoft’s Office 365 GCC High followed a multi‑year review process involving the Department of Justice, accredited 3PAOs, and sustained oversight by the FedRAMP PMO. Over the course of these reviews, additional assessments and validation activities were conducted as requirements evolved. This process culminated in the Fall 2024, with the FedRAMP PMO’s final assessment that resulted in FedRAMP authorization, reflecting a comprehensive evaluation against FedRAMP High security standards.

That authorization signifies satisfaction of applicable security requirements based on documented evidence and risk acceptance by the appropriate authorizing officials. As is standard practice for FedRAMP authorizations and consistent with continuous risk management principles, the authorization included Plans of Actions and Milestones (POA&M) to address residual items under ongoing oversight. This approach aligns with FedRAMP’s established model, in which authorization represents a sustained compliance posture supported by continuous monitoring, rather than a static or one‑time determination.

Throughout the authorization process, Microsoft provided extensive technical artifacts, clarifications, and updated documentation in response to detailed review by accredited 3PAOs and the FedRAMP PMO. These materials were submitted as a comprehensive package that reflected the depth and complexity of assessing a hyperscale cloud environment. Microsoft’s complete security authorization package is made available to agency Chief Information Officers through the FedRAMP PMO, enabling independent government review and informed risk decisions. Iterative exchanges with the PMO and 3PAOs are a normal and expected feature of rigorous FedRAMP High assessments, particularly for large, evolving cloud services.

This effort culminated in Office 365 GCC High being fully authorized at FedRAMP High.

FedRAMP 20x

Under new leadership, the FedRAMP PMO took steps to modernize the FedRAMP process and reduce a backlog of accreditations, while still ensuring the same level of rigorous review and oversight. The FedRAMP reform effort launched in March 2025—often referred to as “FedRAMP 20x”—builds on input from agencies, Congress, and cloud service providers to improve clarity, accountability, and efficiency while preserving rigorous security standards.

We appreciate the Administration’s progress under FedRAMP 20x and welcome continued modernization and transparency in the program. We remain committed to working constructively with government partners to support a FedRAMP program that is both rigorous and responsive, and that continues to earn the trust of agencies, policymakers, and the public.

We stand behind the security of our cloud service offerings, especially those with FedRAMP High authorization. Federal customers can continue to rely on Microsoft’s service with high confidence to support mission‑critical operations. As always, we remain committed to transparency, rigorous compliance, and delivering national‑security‑grade cloud services for the U.S. Government.

Paul Lorimer, Corporate Vice President, Office 365 Enterprise and Cloud Engineering

Unlock the Power of M365 Copilot: Government Prompt-a-thon Comes to Charlotte, NC

Abby_Quinn — Tue, 17 Mar 2026 22:45:30 GMT

Government agencies are under growing pressure to do more with less—modernize operations, increase productivity, and deliver better services to citizens, all while maintaining trust, security, and compliance. On April 8 in Charlotte, North Carolina, government professionals will have the opportunity to experience how M365 Copilot can help meet those challenges head‑on.

The M365 Copilot Prompt‑a‑thon – Government Roadshow is coming to Charlotte, bringing together public sector leaders, IT professionals, and mission owners for an immersive, hands‑on experience focused on real‑world M365 Copilot use cases for government.

This is not a keynote-only event. It’s a working session designed to help you actually use M365 Copilot—confidently, responsibly, and effectively.

What Is a M365 Copilot Prompt‑a‑thon?

A Prompt‑a‑thon is a highly interactive learning experience where attendees go beyond “what M365 Copilot is” and focus on how to use it well. Participants learn how to ask better questions, structure effective prompts, and apply M365 Copilot to everyday government workflows.

Rather than abstract examples, the Prompt‑a‑thon centers on practical, job‑relevant scenarios—the kinds of tasks government employees handle every day, such as:

Drafting and refining documents and guidance
Summarizing long or complex information
Preparing for meetings or briefings
Turning notes and ideas into clear, actionable content
Finding insights across existing work artifacts

Attendees leave with prompt patterns, techniques, and confidence they can immediately bring back to their teams.

Why This Event Matters for Government

M365 Copilot is already transforming how organizations work—but government adoption requires thoughtful implementation. This event is intentionally designed for public sector realities, including:

Security and compliance considerations
Responsible AI usage
Change management and adoption challenges
Supporting diverse roles across IT, operations, policy, and mission teams

The Charlotte Prompt‑a‑thon focuses on helping government organizations move from curiosity to capability—bridging the gap between AI potential and everyday impact.

What You’ll Gain From Attending

By attending the Charlotte Prompt‑a‑thon, participants can expect to:

Learn by Doing

This is a hands‑on experience. You’ll actively work with M365 Copilot and practice prompt techniques you can reuse long after the event ends.

See Real Government Use Cases

Explore scenarios grounded in how government teams actually work—not generic demos.

Build Confidence With M365 Copilot

Understand how to engage M365 Copilot thoughtfully and responsibly, increasing trust and adoption within your organization.

Take Home Practical Assets

Walk away with prompt ideas, workflows, and approaches you can immediately apply and share with colleagues.

Who Should Attend?

This event is ideal for a broad range of government roles, including:

Program and mission leaders
Policy and communications teams
IT and security professionals
Transformation and innovation leads
Knowledge workers looking to improve daily productivity

Whether you are just beginning your M365 Copilot journey or looking to deepen usage across your organization, the Prompt‑a‑thon offers value at every stage.

Why Attend In Person in Charlotte?

The in‑person format allows for deeper engagement, peer learning, and real-time coaching. You’ll have the opportunity to:

Ask questions and experiment live
Learn alongside peers facing similar challenges
Gain insights from Microsoft experts who work closely with government customers

The result is a more meaningful, memorable learning experience—one that accelerates understanding and adoption.

Reserve Your Spot

Seats are limited, and interest in M365 Copilot across government continues to grow. If you’re ready to move beyond AI curiosity and start applying M365 Copilot in practical, responsible ways, this event is for you.

Microsoft 365 Copilot Prompt-a-thon for Government Comes to Boston

Abby_Quinn — Tue, 17 Mar 2026 22:45:24 GMT

On April 8, Microsoft is bringing the Microsoft 365 Copilot Prompt‑a‑thon – Government Roadshow to Boston, MA, inviting State and Local Government and Education customers to experience Copilot in action through a hands‑on, in‑person session.

What You’ll Experience

Participants will:

Practice using Microsoft 365 Copilot through guided, hands‑on exercises
Learn practical prompting techniques tailored to government and education workflows
Explore real scenarios relevant to policy, operations, communications, and IT teams
Leave with skills and examples they can immediately apply and share

This is an interactive working session—not a lecture—focused on learning by doing.

Who Should Attend

This event is designed for:

State and Local Government professionals
Federal End Users
Education sector customers
IT, program, policy, communications, and innovation leaders
Teams beginning or expanding their Copilot adoption journey

Whether you’re exploring Copilot for the first time or looking to drive broader adoption, this session is built to meet public sector needs.

Join Us in Boston

Attending in person provides the opportunity to learn alongside peers, ask questions in real time, and engage directly with Microsoft experts who support government and education customers.

Interested in joining? Reach out to Jay Leask at jay.leask@microsoft.com or Abby Quinn at abby.quinn@microsoft.com.

Don't Miss the Agent-a-thon Coming to Arlington, Virginia April 22!

Abby_Quinn — Tue, 17 Mar 2026 20:08:58 GMT

Don’t Just Hear About AI at Work — Experience It

Register now for the upcoming Microsoft 365 Copilot Agent-a-thon in Arlington, Virginia

AI isn’t “coming someday.” It’s already reshaping how teams write, analyze, collaborate, and deliver outcomes—especially in environments where time, accuracy, and accountability matter.

That’s why this upcoming Agent-a-thon is the one you’ll want on your calendar.

This is your chance to move beyond the hype and get clear, practical insight into how Copilot can help teams work smarter inside the M365 Copilot tools they already use—while keeping governance, security, and responsible use at the center of the conversation.

Why this event matters (and why now)

If your organization is asking any of these questions, you belong in this session:

“Where do we start with agents—without overwhelming users?”
“How do we turn early excitement into real adoption?”
“What use cases actually translate into time saved and better outcomes?”
“How do we maintain trust, controls, and compliance while scaling AI?”

This event is designed to help you walk away with clarity and momentum—not just inspiration.

What you can expect

You’ll explore how M365 Copilot Agents can support real work across everyday tools and workflows—think: turning information overload into summaries, accelerating drafting and revision, helping teams prepare, communicate, and decision faster, and improving consistency in outputs.

Just as important: you’ll get language and framing you can take back to your stakeholders—leadership, IT, security, and end users—to help align on responsible adoption and high‑value scenarios.

Who should attend

Bring your builders, your decision-makers, and end users—this is valuable whether you’re:

Leading productivity or modernization efforts
Supporting end users and change management
Shaping AI governance, security, or compliance
Driving outcomes for a mission, program, or service line
Looking to scale practical “Copilot-first” ways of working

If you’re trying to operationalize AI (not just discuss it), this is for you.

The biggest takeaway: confidence

The best events don’t just inform—they activate. This one is built to help you leave with:

Stronger understanding of where Copilot fits in daily work
Clearer ideas for repeatable, high-impact use cases
Better readiness to talk about adoption and change in a structured way
A practical next step: what to do Monday morning after the event

Seats fill. Momentum matters. Register now.

If you’ve been waiting for the “right moment” to lean into M365 Copilot, this is it.

✅ Save your spot here: Agent-a-thon Registration

And if you know someone who keeps saying, “I want to see what Copilot can really do,” forward this and bring them with you.

ITAR Compliance in the Microsoft Cloud: Navigating GCC, Azure Commercial, and Azure Government

bryanlopez — Fri, 20 Mar 2026 15:11:43 GMT

Why ITAR Compliance Matters in the Cloud

The International Traffic in Arms Regulations (ITAR) govern the export, temporary import, reexport, and transfer of defense articles, services, and related technical data directly related to defense articles listed on the United States Munitions List (USML) as well as furnishing defense services. Administered by the United States’ Department of State's Directorate of Defense Trade Controls (DDTC), the ITAR imposes strict requirements on manufacturers, exporters, and brokers of defense-related items - and those requirements extend to how and where ITAR-controlled data is stored, processed, and accessed in the cloud.

For federal agencies, Defense Industrial Base (DIB) organizations, and government contractors, choosing the right Microsoft cloud environment is not just a technical decision - it is a compliance imperative. Getting it wrong can result in civil penalties, criminal prosecution, loss of export privileges, and the erosion of trust with federal partners. It can even cause the government to bar companies from federal contracts.

This guide walks through how ITAR compliance maps to our cloud offerings - specifically Microsoft 365 GCC, Azure Commercial, and Azure Government - drawing exclusively from official Microsoft documentation to help you make informed decisions about where your ITAR-controlled workloads belong.

Understanding ITAR: Core Requirements

Before evaluating cloud environments, it is essential to understand what the ITAR requires:

Registration with DDTC: Organizations that manufacture, export, or broker defense articles must register with the Directorate of Defense Trade Controls.
Access Restricted to US Persons: ITAR-controlled technical data may only be accessed by US persons unless specific DDTC authorization has been granted.
Prohibition on Unauthorized Export: ITAR-controlled technical data may not be exported - included by making it available to foreign person – without authorization from the DDTC. As described in additional detail below, the ITAR does not impose an affirmative requirement that data be stored within the Continental United States (CONUS). However, storing data within CONUS and restricting access to U.S. persons is a widely adopted mitigation strategy. End-to-End Encryption: The revised ITAR rules, effective March 25, 2020, introduced a carve-out stating that sending, taking, or storing unclassified technical data does not constitute an export if the data is secured using end-to-end encryption with FIPS 140 compliant cryptographic modules, the means of decryption are not provided to any person other than the intended recipient, and the data is not intentionally sent to or stored in a proscribed country listed under 22 CFR § 126.1. Additionally, there are specific requirements for protecting and sharing access information for ITAR data to qualify for the carve-out.

Think of ITAR requirements as a vault within a vault. It is not enough that the building is secure — the room, the safe, and the access list all have to meet the standard independently.

There Is No ITAR Certification

A critical point that often creates confusion: there is no ITAR compliance certification for cloud service providers. We design and operate our in-scope services to be capable of supporting your ITAR obligations and compliance program, but there is no formal ITAR certification to obtain. This means that ITAR compliance is ultimately the responsibility of the data owner — we provide the capable platform, and you are responsible for the protection, architecture, and access controls within your environment.

Reference: International Traffic in Arms Regulations (ITAR) - Azure Compliance | Microsoft Learn

Microsoft Cloud Environments: Where Does ITAR Fit?

Microsoft 365 GCC

Microsoft 365 Government Community Cloud (GCC) is designed for US federal, state, local, and tribal government entities, along with contractors holding or processing data on behalf of the US Government. GCC provides compliance with FedRAMP High, DFARS, and requirements for criminal justice and federal tax information systems.

However, GCC does not natively support ITAR or EAR-controlled data. While GCC stores data within the United States and restricts access to screened personnel, it runs on Microsoft Entra ID Commercial. Support staff may include non-US persons, and we will only agree to ITAR contract language for the GCC High environment - not standard GCC.

Can Compensating Controls Make GCC Viable for ITAR? A Risk-Based Decision

We recognize that not every organization is positioned to leverage to GCC High - whether due to budget constraints, licensing timelines, or operational complexity. For organizations evaluating GCC, it is worth understanding the compensating controls available, the case they enable, and efforts need to reduce risk within their organization.

The core argument for GCC viability rests on four points:

Data never leaves the United States. GCC stores all customer data within US boundaries. Unlike Azure Commercial, where data residency depends on customer configuration, GCC's CONUS data residency is part of the environment boundary itself.
No unauthorized human access. When CMK and Customer Lockbox are implemented together, they eliminate the risk of unauthorized human access to ITAR-controlled data — regardless of the background check status of any individual. CMK ensures that we and our agents cannot decrypt your data without keys your organization controls. Customer Lockbox ensures that in rare instances where our support engineers need elevated access, you explicitly approve or reject every request.
Automated processing stays within the GCC boundary in CONUS. Automated service operations that process your data remain within the GCC environment and do not leave the United States.
Therefore, no export occurs. If the data never leaves the US, no Microsoft employee can access it in decrypted form without explicit customer approval, and all processing remains within CONUS - the conditions that would constitute an export under ITAR are not met.

Customer Managed Keys (CMK): GCC supports customer-managed encryption keys through Azure Key Vault. With CMK, your organization retains exclusive control of the encryption keys that protect your data at rest. Because Azure Key Vault is designed so that we and our agents cannot see or extract your cryptographic keys, CMK is a critical component of meeting the ITAR end-to-end encryption carve-out requirement that the means of decryption are not provided to any third party. This is the critical control - even if a non-US person were to encounter the encrypted data, nothing is revealed because they cannot decrypt it without your keys.

Customer Lockbox: Customer Lockbox for Microsoft 365 provides an explicit access governance gate. In rare instances where our support engineers need elevated access to your data to resolve a service request, Customer Lockbox requires your approval before any access is granted. This gives your organization direct control over who touches your data and when — making the background check status of individual support personnel a secondary concern, because no human access occurs without your authorization.

This is fundamentally a risk-based decision - and one that typically falls to the CISO and organizational leadership to approve and be held accountable for. Organizations that implement CMK and Customer Lockbox in GCC can build a defensible technical case that no export occurs, but they should ensure that decision is documented, reviewed by compliance stakeholders, and aligned with their organization's risk tolerance. For many organizations — particularly those in the DIB handling ITAR-controlled technical data — GCC High will remain the appropriate path because it eliminates these considerations by design.

Bottom line: Ultimately, it is incumbent on the data owner to decide what tools meet their purposes. GCC is suitable for Federally Controlled Information (FCI) and certain categories of Controlled Unclassified Information (CUI). Organizations with ITAR-controlled data may prefer GCC High or DoD environments, but CMK and Customer Lockbox can serve as meaningful compensating controls for organizations managing the transition or making a documented, risk-based determination that the technical controls in GCC are sufficient for their specific use case.

Reference: Office 365 US Government - Service Descriptions | Microsoft Learn

Azure Commercial

Azure Commercial can play a role in supporting ITAR compliance — but with an important distinction from our government cloud environments: the compliance boundary in Azure Commercial is customer-implemented rather than environment-guaranteed.

Both Azure and Azure Government can help you meet your ITAR compliance obligations. Our Azure datacenters (except for the Hong Kong SAR region) are not located in proscribed countries or the Russian Federation. Azure services rely on FIPS 140 validated cryptographic modules and provide multiple options for encrypting data in transit and at rest, including customer-managed keys (CMK) through Azure Key Vault backed by FIPS 140 validated HSMs.

Data Residency in Azure Commercial

While Azure Commercial is not hard-locked to CONUS the way Azure Government is, we provide you with the tools and transparency to control where your data resides. You select the Azure region where your applications and data are deployed. Most Azure services enable you to specify the region where your customer data will be stored and processed, and we will not store or process customer data outside the selected geography. We publish a data residency page and per-service documentation that identifies which services store data at rest in-region and which have global components that may process data outside the selected geography.

To enforce data residency in Azure Commercial, you can leverage region selection during deployment, Azure Policy to restrict resource creation to specific US regions, and service-specific residency controls documented for each service. It is your responsibility to review per-service documentation to understand which services are fully regional and which may have global processing components, and to architect your environment accordingly.

This is the fundamental difference: in Azure Government, the CONUS boundary is part of the environment. In Azure Commercial, you are building that boundary yourself through policy, encryption, access controls, and deliberate architecture choices for the available localized services.

The Encryption Carve-Out

The key enabler for ITAR in Azure Commercial is the ITAR end-to-end encryption carve-out. The ITAR states that storing encrypted technical data does not constitute an export when the data is unclassified, encrypted end-to-end with FIPS 140 compliant modules, and not intentionally stored in a proscribed country. Also, the means of encryption must not be provided to a third party. Azure Key Vault is designed so that Microsoft and its agents cannot see or extract customers’ cryptographic keys. Customer Lockbox for Azure puts you in charge of approving or rejecting any elevated access requests from our support engineers, providing an additional layer of access governance.

However, Azure Commercial does not provide the additional contractual commitments that Azure Government offers, such as guaranteed storage within the United States and access limited exclusively to screened US persons. The compliance controls are available to you - but the responsibility for implementing, configuring, and maintaining them rests entirely with your organization.

Bottom line: Azure Commercial can support ITAR workloads under the encryption carve-out, but you are building and enforcing the compliance boundary yourself. Most organizations with ITAR obligations are best served by Azure Government, where the boundary is built into the environment.

Reference: International Traffic in Arms Regulations (ITAR) - Azure Compliance | Microsoft Learn

Azure Government

Azure Government is a physically and logically isolated cloud environment built specifically for US government agencies and their partners. Data transmission and processing are restricted to CONUS, and access to systems processing customer data is limited to screened US persons. Azure Government provides contractual commitments regarding data residency and personnel access that go beyond what Azure Commercial offers.

Azure Government holds FedRAMP High authorization and supports DISA SRG Impact Level 5 (IL5), ITAR, and Export Administration Regulations (EAR). For organizations that need to store and process ITAR-regulated data, Azure Government provides the strongest alignment with ITAR requirements available in our cloud ecosystem.

Key capabilities that support ITAR compliance in Azure Government include:

Data location control: Robust tools to restrict data storage to US regions, ensuring customer data is not intentionally stored in a non-conforming location.
Access controls: Our technical support personnel do not have default access to customer data. Customer Lockbox for Azure enables you to approve or reject any elevated access requests.
End-to-end encryption: FIPS 140 validated cryptographic modules with customer-managed key options through Azure Key Vault HSMs.
Screened US citizens: Personnel with potential access to customer data undergo verification of US citizenship and additional background screening. This is more than what the ITAR requires, which is a US person.

Bottom line: Azure Government is the recommended environment for ITAR-controlled workloads and provides the strongest contractual and technical protections.

Reference: Azure support for export controls | Microsoft Learn

Microsoft 365 GCC High and DoD

For organizations that need Microsoft 365 productivity services (Exchange, SharePoint, Teams, OneDrive) alongside ITAR compliance, GCC High is the appropriate environment. GCC High is built on Azure Government infrastructure, stores data exclusively in US data centers, and limits access to screened US citizens. We will agree to ITAR contract language for the GCC High environment.

The Office 365 GCC High and DoD environments deliver compliance with Department of Defense Security Requirements Guidelines, DFARS, and ITAR. You must sign additional agreements notifying us of your intention to store ITAR-controlled data so that we can comply with our obligations to both you and the US government.

Reference: Office 365 GCC High and DoD - Service Descriptions | Microsoft Learn

Comparing the Environments at a Glance

Capability	GCC	Azure Commercial	Azure Government	GCC High / DoD
ITAR Contract Language	No	No	Yes	Yes
Data Residency (CONUS)	US only (environment boundary)	Customer-configured via region selection, Azure Policy, and per-service residency controls	US only (contractual)	US only (contractual)
Compliance Boundary	Environment-guaranteed	Customer-built through policy, encryption, and architecture	Environment-guaranteed	Environment-guaranteed
Personnel Screening (US Persons)	Screened personnel, but support staff may include non-US persons	No specific commitment	Screened US persons	Screened US citizens
Physical/Logical Isolation	Logical segregation on Azure Commercial	Shared commercial infrastructure	Physically isolated	Physically isolated (Azure Gov)
FIPS 140 Encryption	Yes	Yes	Yes	Yes
Customer Managed Keys (CMK)	Yes (Azure Key Vault)	Yes (Azure Key Vault)	Yes (Azure Key Vault)	Yes (Azure Key Vault)
Customer Lockbox	Yes	Yes	Yes	Yes
FedRAMP Authorization	FedRAMP High	Varies by service	FedRAMP High	FedRAMP High
ITAR-Capable	Not natively; CMK + Customer Lockbox enable a defensible no-export case (risk-based decision)	Under encryption carve-out (customer-built boundary)	Yes	Yes

Shared Responsibility: Your Role in ITAR Compliance

Regardless of which cloud environment you choose, ITAR compliance is a shared responsibility. We provide the platform capabilities — encryption, data residency, access controls, and personnel screening — but your organization is responsible for:

Registering with DDTC if you manufacture, export, or broker defense articles.
Classifying and labeling data to identify ITAR-controlled technical data.
Configuring access controls to ensure only authorized US persons can access regulated information.
Signing additional agreements with us to formalize your intention to store ITAR-controlled data (required for Azure Government and GCC High).
Designing application architecture to maintain end-to-end encryption that meets ITAR requirements. We do not inspect, approve, or monitor your applications.
Managing third-party integrations that may fall outside the compliance boundary.

The Microsoft Enterprise Agreement Amendment enables us and the customer to work together in reporting ITAR violations, fulfilling the specific reporting obligations that ITAR requires.

Reference: International Traffic in Arms Regulations (ITAR) - Microsoft Compliance | Microsoft Learn

Action Plan for Getting Started

Step 1: Assess Your Data Determine whether your organization handles defense articles, services, or technical data on the USML. Understand which data is ITAR-controlled and map your data flows.

Step 2: Choose the Right Environment For ITAR-controlled workloads, Azure Government and Microsoft 365 GCC High provide the strongest alignment. If you are evaluating GCC with compensating controls like CMK and Customer Lockbox, or Azure Commercial under the encryption carve-out, ensure the decision is documented and approved by your CISO and compliance stakeholders — as the CISO is ultimately accountable for the risk acceptance and the defensibility of the chosen approach.

Step 3: Engage Your Microsoft Account Team If you are seeking to host ITAR-controlled data, work with your Microsoft account and licensing teams to obtain proper agreements and access relevant system architecture information.

Step 4: Develop Your Compliance Architecture Leverage tools like Azure Policy, Microsoft Defender for Cloud, Microsoft Purview Compliance Manager, and Customer Lockbox to enforce and monitor your compliance posture.

Step 5: Document and Maintain Develop a System Security Plan (SSP) that reflects your ITAR controls, and continuously monitor and update your controls as your environment evolves.

Resources and Further Reading

Conclusion

ITAR compliance in the cloud is achievable - but it requires deliberate environment selection, proper contractual agreements, and disciplined architecture. Microsoft 365 GCC does not natively support ITAR, but Customer Managed Keys and Customer Lockbox can enable a defensible technical case that no export occurs - a risk-based decision that falls to the CISO and organizational leadership to approve. Azure Commercial can support ITAR under the encryption carve-out, but the compliance boundary is customer-built rather than environment-guaranteed, which demands careful architecture and per-service residency review. Azure Government and GCC High provide the contractual commitments, data residency guarantees, and personnel screening that most closely align with ITAR requirements — with the compliance boundary built into the environment by design.

The path forward starts with understanding your data, choosing the right environment, and building your compliance architecture on our capable platform.

Join the Discussion

Join the conversation below to ask questions, share deployment insights, and connect with other public sector professionals working with Microsoft capabilities. Your feedback and experience help strengthen the community.

Public Sector Blog articles

What's Next in Microsoft 365 Copilot for Government

Bring context-aware AI into the flow of work

Turn collaboration into action

Advancing AI for the work of government

Stay up to date

Build Your First AI Agent in a Day: Join the M365 Copilot Government Roadshow in Tempe

The Era of Agents Is Here

What Makes This Event Different?

A Full Day of Learning, Building, and Collaboration

Why Government Professionals Should Attend

Event Details

Seats Are Limited

Ready to Build?

Advanced Microsoft Intune capabilities are now available for GCC High

What this changes for your endpoint estate

What is included in G3 and G5

How to put these capabilities to work

Reducing standing administrator rights

Getting proactive with device data

Streamlining application delivery

Managing mobile, specialty, and frontline devices

Faster, auditable remote support

Modernizing certificate infrastructure

What changes for the people using the devices

What changes for your security posture

Recommended next steps for GCC High customers

Resources

Kick Off the Fall by Building the Future: Join Microsoft's Government Agent-a-thon in Arlington, VA

The Next Evolution of AI is Here

Learn by Building

Real-World Outcomes, Not Just Theory

Connect with Peers Across Government

Why You Should Attend

Event Agenda

Be Part of the Future of Government Innovation

M365 Copilot Government Roadshow is BACK! Kicking off in Atlanta with our First Ever Agent Bootcamp!

M365 Copilot Government Roadshow: Agent Bootcamp

Why Agents Matter

What You'll Experience

Who Should Attend?

City of Raleigh from insights to action: A traffic digital twin, live in six weeks

What’s new in Microsoft 365 Copilot for U.S. Government Customers

Microsoft 365 Copilot: Help employees work with organizational knowledge

Shared controls: Govern AI and agents at scale

Continuing updates for U.S. Government customers

Reproducing an AI Action Plan Analysis with the Microsoft Discovery App

Setting the scene

What Microsoft Discovery is

The experiment, re-run — in three steps

Step 1 — Load the data

Step 2 — Initialize the project

Step 3 — Autopilot Go

A look at what came back

Parting thoughts

Related reading

Empowering the Mission at the Edge with Azure Local

Why is the Edge so important to Mission?

What is Azure Local?

Recent Announcements:

Azure Local disconnected operations (ALDO):

Mission Reference Architecture:

Key Components of the Architecture:

Cloud Connected Resilient Architecture:

How does Data Flow through this solution?

What are some of the key architectural considerations?

What are the advantages of this architecture?

What are the key integrations?

Fully Cloud Disconnected Architecture:

Adaptive Cloud and Innovation at the Edge:

Microsoft SPARK: Powering America’s Genesis Mission for Scientific Discovery

The Genesis Mission: A National Commitment to Discovery

Introducing SPARK: Microsoft’s Answer to the Mission

1. A Dedicated Program Management Office

2. An AI-for-Science Center of Excellence

3. Substantial Azure Cloud Service Credits

4. Professional and Technical Services Investment

5. Joint Research & Development

The Technology Behind SPARK

Why This Matters

NEW LOCATION!
📍 UAH Invention to Innovation Center (I2C), 850 Ben Graves Dr NW, Huntsville, AL 35816